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LISTING OF THE CLAIMS : 

This listing of claims will replace all prior versions, and listings, of claims in the application: 

Claim 1 (Original) A method for analyzing a potential cause of a change in a service, wherein 
service quality of the service is monitored, usage of the service is measured, and service events 
are detected, the method comprising: 

determining a service change time window based at least in part upon a change in 
service quality between a first working state and a second, non-working state, and upon a change 
in service usage amount, the service change time window encompassing at least part of a service 
outage; 

retrieving data representing a detected event and a time in which the event 

occurred; and 

computing a probability that the detected event caused the service change based at 
least in part on a correlation between the event time and the service change time window. 

Claim 2 (Original) The method of claim 1, wherein determining the service change time 
window comprises determining a service failure time window based upon the change in service 
quality and narrowing the service failure time window to the service change time window based 
upon the service usage amount measured during that service failure time window. 

Claim 3 (Original) The method of claim 2, wherein the service quality is monitored through 
periodic polling of the service quality, and comprising determining the service failure time 
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window as bounded by a polled point of the first working state and a polled point of the second, 
non-working state. 

Claim 4 (Original) The method of claim 1, wherein computing the probability comprises 
computing the probability using at least in part a time weighting function which decreases 
exponentially with the distance between the event time and the service change time window. 

Claim 5 (Original) The method of claim 1 , comprising determining whether one or more 
other events of a type identical to the detected event occurred, and wherein computing the 
probability comprises computing the probability using at least in part a false occurrence 
weighting function which decreases the probability of the detected event as the cause of the 
service change for instances in which the detected event occurred outside the service change time 
window. 

Claim 6 (Original) The method of claim 1, comprising storing historical data associating 
occurrences of prior events with prior service changes, and wherein computing the probability 
that the detected event caused the service change comprises computing the probability based at 
least in part on the historical data. 

Claim 7 (Original) The method of claim 6, wherein storing historical data comprises storing 
data representing instances in which prior events occurred within prior service change time 
windows, and wherein computing the probability that the detected event caused the service 
change comprises using at least in part a positive occurrence weighting function which increases 
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the probability of the detected event as the cause of the service change based on instances in the 
historical data in which a prior event of a type identical to the detected event occurred within a 
prior service change time window. 

Claim 8 (Original) The method of claim 6, wherein storing historical data comprises storing 
data representing instances in which prior events were identified as having caused prior service 
changes, and wherein computing the probability that the detected event caused the service 
change comprises using at least in part a historical weighting function which increases the 
probability of the detected event as the cause of the service change based on instances in the 
historical data in which a prior event of a type identical to the detected event was identified as 
having caused a prior service change. 

Claim 9 (Original) The method of claim 1 , comprising retrieving data representing a plurality 
of detected events and corresponding event times, and wherein computing the probability 
comprises computing probabilities for each of the plurality of detected events. 

Claim 10 (Original) The method of claim 9, wherein computing probabilities comprises 
computing the probabilities such that the total of all computed probabilities is 1 . 

Claim 1 1 (Original) The method of claim 1, wherein the service comprises service over a 
communication network and wherein the detected event comprises a network event. 
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Claim 12 (Original) The method of claim 1, wherein the service comprises service provided by 
an application program and wherein the detected event comprises an application program event. 

Claim 13 (Original) The method of claim 1, wherein the service change is a service outage, 
comprising determining the service change time window as a change in service quality from the 
first working state to the second, non-working state. 

Claim 14 (Original) The method of claim 1, wherein the service change is a service recovery, 
comprising determining the service change time window as a change in service quality from the 
second, non- working state to the first, working state. 

Claim 15 (Original) The method of claim 1, wherein determining the service change time 
window comprises detecting a change in service quality by detecting a step change in measured 
usage. 

Claim 16 (Original) A method for analyzing potential causes of a service change, the method 
comprising: 

determining a service change time window encompassing a change of service 
between a first working state and a service outage, the service change being determined at least 
in part based on measured service usage levels; 

detecting occurrences of a set of events within a given time prior to and during the 
service change time window, each occurrence of an event being associated with a time at which 
the event occurred; and 
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computing a probability distribution for the set of events, which probability 
distribution determines for each event in the set the probability that the detected event caused the 
service change, the probability distribution being based at least in part on relations between the 
time of each event occurrence and the service change time window. 

Claim 1 7 (Original) The method of claim 1 6, wherein computing the probability distribution 
for the set of events comprises computing the probability distribution using a first weighting 
function which is the product of two or more second weighting functions. 

Claim 18 (Original) The method of claim 16, wherein the two or more second functions are 
selected from the group consisting of: 

a time weighting function which decreases exponentially the probability of a 
given event as the cause of the service change with the distance between the given event time 
and the service change time window; 

a false occurrence weighting function which decreases the probability of a given 
event as the cause of the service change for instances in which events of the same type as the 
given event occurred outside the service change time window; 

a positive occurrence weighting function which increases the probability of a 
given event as the cause of the service change based on instances stored in a historical database 
in which events of the same type as the given event occurred within a prior service change time 
window; and 
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a historical weighting function which increases the probability of a given event as 
the cause of the service change based on instances in the historical database in which events of 
the same type as the given event were identified as having caused a prior service outage. 

Claim 19 (Original) The method of claim 18, wherein the step of computing the probability 
distribution comprises using a first weighting function which is the product of the time weighting 
function, false occurrence weighting function, positive occurrence weighting function, and user 
weighting function. 

Claim 20 (Original) The method of claim 16, comprising monitoring service quality, and 
wherein determining the service change time window comprises determining a service failure 
time window based upon a change in monitored service quality and narrowing the service failure 
time window to the service change time window based upon the service usage amount measured 
during that service failure time window. 

Claim 21 (Original) The method of claim 20, wherein the service quality is monitored through 
periodic polling of the service quality, and comprising determining the service failure time 
window as bounded by a polled point of the first working state and a polled point of the second, 
non-working state. 

Claim 22 (Original) The method of claim 16, comprising computing the probability 
distribution such that the total of all probabilities in the distribution is 1 . 
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Claim 23 (Original) The method of claim 16, wherein the service comprises service over a 
communication network and wherein the detected events comprise network events. 

Claim 24 (Original) The method of claim 16, wherein the service comprises service provided 
by an application program and wherein the detected events comprise application program events. 

Claim 25 (Original) The method of claim 16, wherein the service change is a service outage, 
comprising determining the service change time window as a change in service from the first 
working state to the second, non- working state. 

Claim 26 (Original) The method of claim 16, wherein the service change is a service recovery, 
comprising determining the service change time window as a change in service from the second, 
non-working state to the first, working state. 

Claim 27 (Currently Amended) The method of claim 1 16, wherein determining the service 
change time window comprises detecting a step change in measured usage. 

Claim 28 (Original) A network monitoring system comprising: 

a service monitor for monitoring quality of service on the network; 
a usage meter for measuring usage of the network; 

an event detector for detecting network events and times at which the network 
events occur; and 
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a probable cause engine, coupled to receive data from the service monitor, usage 
meter, and the event detector, for: 

setting a service change time window based upon data received from the service 
monitor or usage meter, the service change time window encompassing at least part of an 
occurrence of a service outage in the network; and 

determining which of the network events detected by the event detector is the 
most likely cause of a service change based at least in part of the relations of the detected 
network event times to the service change time window. 

Claim 29 (Original) A computer readable medium storing program code for, when executed, 
causing a computer to perform a method for analyzing a potential cause of an change in a 
service, wherein service quality of the service is monitored, usage amount of the service is 
measured, and service events are detected, the method comprising: 

determining a service change time window based at least in part upon a change in 
service quality between a first working state and a second, non-working state, and upon a change 
in service usage amount, the service change time window encompassing at least part of a service 
outage; 

retrieving data representing a detected event and a time in which the event 

occurred; and 

computing a probability that the detected event caused the service change based at 
least in part on a correlation between the event time and the service change time window. 

Claims 30-61 (Withdrawn) 
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Claim 62 (Previously added) Computer readable media comprising program code that, when 
executed by a programmable microprocessor, causes the programmable microprocessor to 
execute a method for analyzing potential cause of a service change, the method comprising: 

determining a service change time window encompassing a change of service 
between a first working state and a service outage, the service change being determined at least 
in part based on measured service usage levels; 

detecting occurrences of a ser of events within a given time prior to and during 
the service change time window, each occurrence of an event being associated with a time at 
which the event occurred; and 

computing a probability distribution for the set of events, which probability 
distribution determines for each event in the set the probability that the detected event caused the 
service change, the probability distribution being based at least in part on relations between the 
time of each event occurrence and the service change window. 

Claim 63 (Previously added) The computer readable media comprising program code of claim 

62 that, when executed by a programmable microprocessor, causes the programmable 
microprocessor to execute a method for analyzing potential cause of a service change, wherein 
computing the probability distribution for the set of event comprises computing the probability 
distribution using a first weighting function which is the product of two or more second 
weighting functions. 

Claim 64 (Previously added) The computer readable media comprising program code of claim 

63 that, when executed by a programmable microprocessor, causes the programmable 
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microprocessor to execute a method for analyzing potential cause of a service change, wherein 
the two or more second functions are selected from the group consisting of: 

a time weighting function which decreases the probability of a given event 
as the cause of the service change with the distance between the given event time and the service 
change time window; 

a false occurrence weighting function which decreases the probability of a 
given event as the cause of the service change for instances in which events of the same type as 
the given event occurred outside the service change time window; 

a positive occurrence weighting function which increases the probability 
of a given event as the cause of the service change based on instances stored in a historical 
database in which events of the same type as the given event occurred within a prior service 
change time window; and 

a historical weighting function which increases the probability of a given 
event as the cause of the service change based on instances in the historical database in which 
events of the same type as the given event were identified as having caused a prior service 
outage. 

Claim 65 (Previously added) The computer readable media comprising program code of claim 
62 that, when executed by a programmable microprocessor, causes the programmable 
microprocessor to execute a method for analyzing potential cause of a service change, the 
method comprising monitoring service quality, an wherein determining the service change time 
window comprises determining a service failure time window based upon a change in monitored 
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service quality and narrowing the service failure time window to the service change time window 
based upon the service usage amount measured during the service failure time window. 

Claim 66 (Previously added) The computer readable media comprising program code of claim 
62 that, when executed by a programmable microprocessor, causes the programmable 
microprocessor to execute a method for analyzing potential cause of a service change, the 
method comprising computing the probability distribution such that the total of all probabilities 
in the distribution is 1 . 

Claim 67 (Previously added) The computer readable media comprising program code of claim 
62 that, when executed by a programmable microprocessor, causes the programmable 
microprocessor to execute a method for analyzing potential cause of a service change, wherein 
the service comprises service over a communication network and wherein the detected events 
comprise network events. 

Claim 68 (Previously added) The computer readable media comprising program code of claim 
62 that, when executed by a programmable microprocessor, causes the programmable 
microprocessor to execute a method for analyzing potential cause of a service change, wherein 
the service comprises service provided by an application program and wherein the detected 
events comprise application program events. 

Claim 69 (Previously added) The computer readable media comprising program code of claim 
62 that, when executed by a programmable microprocessor, causes the programmable 
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microprocessor to execute a method for analyzing potential cause of a service change, wherein 
the service change is a service outage, comprising determining the service change time window 
as a change in service from the first working state to the second, non-working state. 

Claims 70-77 (Withdrawn) 
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